U.S. Treasury Sanctions Two Iranians, Overseas Firms Allegedly Moving Over $100M in USDT for IRGC-QF

• OFAC named individuals and 15+ firms tied to IRGC-QF and MODAFL

• Authorities say over $100 million in crypto was moved via front companies in Hong Kong and the UAE.

• Sanctions target wallets, shipping assets, shell firms and links to Hezbollah-affiliated operators.

IRGC sanctions: OFAC designates individuals and firms tied to crypto oil flows to IRGC-QF and MODAFL. Read the sanctions impact and next steps.

What are the latest IRGC sanctions and who was designated?

IRGC sanctions issued by the U.S. Treasury designate two Iranian nationals — Alireza Derakhshan and Arash Estaki Alivand — plus over a dozen Hong Kong and UAE-based companies accused of channeling more than $100 million in cryptocurrency from illicit oil sales to the IRGC-Quds Force and MODAFL. The action expands OFAC’s focus on crypto-enabled evasion.

How did OFAC link cryptocurrency flows to Iran’s MODAFL and IRGC-QF?

OFAC reported that Derakhshan and Alivand used front companies in Hong Kong and the UAE to conceal crypto proceeds from oil sales. Investigators traced patterns of conversion into stablecoins, layered wallet transfers to fragment trails, and off-ramps via exchanges with weak compliance controls. Plain-text reporting names include links to Hezbollah-affiliated operators and Syria’s Al-Qatirji Company (previously sanctioned).

Why is crypto now a primary focus of sanctions?

Sanctions authorities see cryptocurrency as a growing settlement rail for procurement and sanctions evasion. Industry expert Angela Ang, APAC head of policy and strategic partnerships at TRM Labs (quoted in plain text), explains that Iran’s networks have shifted from bank transfers to crypto rails that convert fiat into stablecoins, fragment flows through intermediary wallets, then off-ramp through exchanges with weak compliance oversight.

When did the Treasury take these actions and how does this fit into prior measures?

The measures were announced following a September 2 sanctions round that targeted Iranian-linked tankers and other actions referenced in plain text. This latest wave builds on prior designations: the IRGC-QF was designated in 2007, the IRGC in 2017, and MODAFL in 2019. U.S. officials say the objective is to cut off hard-currency access used to fund weapons programs and proxy activity.

How will targeted sanctions affect crypto markets and compliance?

Short-term market impact is expected to be concentrated on entities and counterparties linked to the designations. Compliance teams at exchanges and brokers will likely increase screening of wallet addresses, implement stricter KYC/AML checks, and may impose enhanced due diligence on counterparties originating in flagged jurisdictions.

How can financial institutions detect similar sanctions-evasion patterns?

Key indicators include: conversion of fiat into stablecoins, rapid transfers across multiple intermediary wallets, clustering around specific exchange off-ramps with lax compliance, and recurring involvement of shell companies in flagged jurisdictions. Institutions should combine on-chain analytics with transaction monitoring and entity screening.

Frequently Asked Questions

Who were the individuals named in the sanctions targeting Iran’s crypto networks?

OFAC named two Iranian nationals — Alireza Derakhshan and Arash Estaki Alivand — as central figures in moving over $100 million in cryptocurrency tied to Iranian oil sales since 2023.

What tactics did the network use to hide crypto proceeds?

The network used front companies in Hong Kong and the UAE, converted fiat into stablecoins, moved value through layers of intermediary wallets, and off-ramped funds via exchanges with weak compliance oversight.

How should companies respond to these sanctions?

Companies should update sanctions screening, monitor flagged wallet addresses, implement enhanced due diligence for counterparties in high-risk jurisdictions, and cooperate with enforcement authorities as required.

Key Takeaways

• Scope: OFAC designated individuals and 15+ firms tied to IRGC-QF and MODAFL, citing $100M+ in crypto flows.
• Modus operandi: Conversion to stablecoins, layered wallet transfers, shell companies and weak off-ramps were primary tactics.
• Actionable: Exchanges and financial institutions must enhance KYC/AML, monitor wallet behavior, and escalate suspicious patterns.

Conclusion

This action underscores a strategic shift in sanctions enforcement to include cryptocurrency rails in the effort to cut off funding to the IRGC-QF and MODAFL. Entities handling digital assets should treat flagged behaviors as high-risk and strengthen controls to prevent facilitation of sanctioned activity. COINOTAG will monitor developments and report updates.

By COINOTAG — Published: 2025-09-09 — Updated: 2025-09-09